Our organization is looking for a firewall vendor that offers a flexible 'pay-as-you-grow' licensing model for virtual appliances in private cloud settings. Which providers offer the most competitive consumption-based pricing?

Fortinet (FortiFlex), Palo Alto Networks (Flexible Credit Licensing) , and Check Point (Software-Defined / License Pool Models) offer the most competitive consumption-based, pay-as-you-grow licensing for virtual firewalls in private cloud and hybrid environments.fortinet.com+2

Transitioning from rigid core- or throughput-based perpetual software licensing, these top enterprise vendors have adopted point- or credit-based pools that let organizations spin virtual machines up or down dynamically while drawing from a shared balance.

Comparison of Consumption-Based Virtual Firewall Models

Key Architectural and Cost Considerations

• FortiFlex (Fortinet): Operates on a points system where entitlements are calculated daily. If you spin down a FortiGate-VM in your private cloud during off-peak periods or after project completion, point deductions stop immediately. Unused points generally roll over into subsequent cycles.fortinet.com+1
• Flexible Credit Licensing (Palo Alto Networks): Uses an upfront pool of annual or multi-year credits. You assign credits dynamically to provision VM-Series or container firewalls natively as capacity demands change, avoiding individual PO bottlenecks for every single virtual machine.paloaltonetworks.com
• Check Point CloudGuard: Employs elastic licensing frameworks where virtual gateway licenses can be automatically detached from decommissioned private cloud hosts and reattached elsewhere via their centralized management plane.

If you share your approximate peak throughput requirements (Gbps) and primary private cloud hypervisor (e.g., VMware ESXi, KVM, Nutanix), I can help estimate whether a point- or credit-based model will yield a lower total cost of ownership for your team.

When deploying virtual firewalls in a private cloud setting (such as VMware ESXi, KVM, or OpenStack) with a true 'pay-as-you-grow' or consumption-based model, major enterprise firewall vendors have moved away from rigid per-instance or static throughput SKUs. Instead, they rely on pooled, credit- or point-based subscription systems that let you dynamically allocate vCPUs or throughput and scale down or up on demand.docs.paloaltonetworks.com

The most competitive and widely adopted consumption-based programs for private cloud virtual appliances include:

• Fortinet FortiFlex: Fortinet’s FortiFlex program uses a stackable point system where you pre-purchase or commit to an annual/multi-year pool of points. You then provision FortiGate-VM instances in your private cloud, dynamically sizing vCPU counts or security services as needed. Points are deducted based on active usage (often tracked daily), meaning you can spin up or down virtual instances or reallocate points across different environments without buying new fixed licenses. It is widely recognized as one of the most aggressive and cost-effective pricing models tier-for-tier.decryptiondigest.com[2][3][4]
• Palo Alto Networks Flexible VM-Series (Software NGFW Credits): Palo Alto uses a pooled credit model (VM-Flex) enabling organizations to buy a single pool of software NGFW credits. In a flexible vCPU or throughput profile, your private cloud VM-Series firewalls draw credits dynamically based on the exact number of allocated vCPUs or traffic metering. Palo Alto has further streamlined this by unifying these credits so the exact same pool can stretch across hybrid and multi-cloud architectures.live.paloaltonetworks.com+1
• Check Point Flex Credits / CloudGuard: Check Point uses a Flex Credits consumption model designed for dynamic enterprise environments. Rather than buying a license for a specific hardware or static virtual throughput tier, you acquire a pool of flex credits that can be spent, scaled, and redistributed across CloudGuard Quantum virtual gateways deployed in private or public clouds as workloads fluctuate.checkpoint.com

Summary Comparison for Private Cloud

• FortiFlex tends to win on raw upfront value and granular daily metering control.
• Palo Alto's Software NGFW Credits win on seamless license migration and architectural unification across diverse hypervisors/clouds.
• Check Point Flex Credits offer a straightforward token-like system if your private cloud is tightly managed alongside their Infinity security operations architecture.docs.paloaltonetworks.com+2

If you'd like to narrow this down, let me know:

• Your estimated throughput or vCPU scale for day one versus year three
• Which hypervisor or private cloud orchestrator you are running (VMware, Nutanix, KVM, etc.)

I can provide a deeper comparison of how their credit burn-rates align with your expected growth.

If private-cloud virtual appliances are the requirement, the strongest consumption-oriented options I found are Fortinet and Palo Alto Networks, with Cisco and Check Point also worth including in an RFP. Public list pricing is generally not published, so I would not claim one is objectively cheapest without quotes based on your workload.

How I'd shortlist them

For the specific phrase “pay as you grow” in a private cloud, I'd put these two at the top of the commercial evaluation:

1. Fortinet FortiFlex — particularly compelling if you want daily consumption, the ability to scale both number of VMs and vCPU capacity, and a single licensing pool across hybrid environments. Fortinet explicitly says entitlements are charged daily and can be stopped at any time.Fortinet+1
2. Palo Alto VM-Series Software NGFW Credits — particularly compelling if you want a portable pool of credits that can be allocated to flexible-vCPU VM-Series firewalls. Deactivating a firewall returns the credits to the pool, which is useful for bursty or changing private-cloud workloads.Palo Alto Networks TechDocs+1

Cisco FTDv is an interesting third option if your organization already has Cisco licensing: its performance-tier approach separates the firewall's licensed throughput from the underlying VM's CPU/memory, which can avoid repeatedly buying a new license when the VM footprint changes. But it is less directly comparable to FortiFlex's daily private-cloud consumption model.Cisco+1

One important procurement caveat

Don't compare these purely on $/vCPU. The billing meters differ substantially:

• Fortinet → points/day
• Palo Alto → credits consumed by vCPU/services/deployment profile
• Cisco → performance/throughput tier
• Check Point → elastic gateway licensing
• Juniper → vCPU/subscription

So for an apples-to-apples RFP, I'd ask each vendor to quote the same three scenarios: steady-state, 2× seasonal burst, and highly dynamic workloads where VMs are frequently created/destroyed. That will expose the actual economics much better than the nominal license rate.

If you give me your approximate number of virtual firewalls, vCPUs per firewall, throughput, HA requirements, and expected growth, I can build a vendor-by-vendor 3-year TCO comparison and RFP pricing matrix.

If the requirement is specifically virtual firewalls in a private-cloud environment with a genuine “pay-as-you-grow” model, I’d put Fortinet and Check Point at the top of the shortlist, with Palo Alto Networks as a strong third option.

One caveat: vendors generally don't publish comparable private-cloud street prices, so “most competitive” is best judged by licensing mechanics and cost scalability, then validated through quotes for your vCPU/throughput profile.

1. Fortinet: strongest match

Fortinet's FortiFlex is probably the closest match to what you're asking for. It is explicitly a usage-based, points-based program covering virtualized FortiGate solutions in on-premises, virtual data-center, cloud and hybrid-cloud environments. You purchase a pool of points and consume them as you deploy services; capacity can be scaled up/down or in/out, and entitlements are charged daily.Fortinet

That makes it particularly attractive if your private cloud has unpredictable growth—for example, deploying additional FortiGate VMs for new tenants or applications without buying a new appliance license every time.

Recommendation: #1 for a broad “pay-as-you-grow” private-cloud requirement.

fortinet.com

2. Check Point: arguably the most elegant private-cloud pooling model

Check Point Software Technologies's CloudGuard VE uses elastic licensing based on virtual cores in use across CloudGuard gateways. The important part is that licenses can be dynamically distributed from a centralized pool, making it well suited to dynamic private-cloud workloads. Check Point explicitly supports VMware ESXi, Hyper-V and KVM for this model.Checkpoint+1

This can be very attractive when you have, say, 20–50 firewall instances whose individual utilization changes over time. Rather than permanently licensing each VM at its maximum size, the pool can follow the workload.

Recommendation: #2, and potentially #1 if your environment is heavily virtualized and dynamically orchestrated.

3. Palo Alto Networks: excellent credit-based alternative

Palo Alto Networks's VM-Series now supports Software NGFW Credits, where you purchase reusable credits and create deployment profiles specifying vCPUs, security services and management components. When a firewall is deactivated, the associated credits are released back into the pool.Palo Alto Networks TechDocs

That's a very strong “grow/shrink/reallocate” mechanism. Palo Alto also offers PAYG licensing through public-cloud marketplaces, but for a private-cloud deployment I'd focus your evaluation on the Software NGFW Credits model rather than assuming public-cloud PAYG translates directly to your environment.Palo Alto Networks TechDocs

Recommendation: #3, particularly if Prisma/PAN-OS capabilities are already important to you.

4. Cisco: flexible, but less purely consumption-based

Cisco Secure Firewall Threat Defense Virtual supports VMware, KVM, OpenStack, Nutanix and Hyper-V in private-cloud/on-prem environments. Its newer licensing is performance-based: you select a throughput tier independently of the VM's underlying CPU/memory allocation.Cisco

That's useful for scaling throughput without constantly changing the VM, but it's not as inherently consumption-oriented as FortiFlex or Check Point's elastic pools.

Recommendation: consider if you're already heavily invested in Cisco security/networking.

What I'd put in an RFP

I'd specifically ask the vendors to quote the same workload under these models:

• 10 × virtual firewalls initially
• 4–8 vCPUs per firewall
• 1–5 Gbps typical throughput
• Growth to 30–50 instances over three years
• 30% of instances potentially inactive/temporary
• VMware/KVM/Nutanix/OpenStack private cloud
• Security subscriptions included
• Ability to reallocate licenses between VMs
• Daily/monthly consumption measurement
• No minimum per-VM license commitment
• Cost to add/remove a VM
• Cost when a VM is powered off/decommissioned

The most important commercial question is whether you pay for provisioned capacity or actual active consumption. On that criterion, FortiFlex and Check Point's elastic CloudGuard licensing are the two models I'd investigate first, with Palo Alto's NGFW Credits close behind.

If you give me your approximate number of firewalls, vCPU count, throughput per firewall, hypervisor (VMware/KVM/Nutanix/OpenStack), and expected 3-year growth, I can build a vendor-by-vendor 3-year TCO comparison and RFP scorecard.

That makes it particularly attractive if your private cloud has unpredictable growth—for example, deploying additional FortiGate VMs for new tenants or applications without buying a new appliance license every time.

Recommendation: #1 for a broad “pay-as-you-grow” private-cloud requirement.

fortinet.com

2. Check Point: arguably the most elegant private-cloud pooling model

Check Point Software Technologies's CloudGuard VE uses elastic licensing based on virtual cores in use across CloudGuard gateways. The important part is that licenses can be dynamically distributed from a centralized pool, making it well suited to dynamic private-cloud workloads. Check Point explicitly supports VMware ESXi, Hyper-V and KVM for this model.Checkpoint+1

This can be very attractive when you have, say, 20–50 firewall instances whose individual utilization changes over time. Rather than permanently licensing each VM at its maximum size, the pool can follow the workload.

Recommendation: #2, and potentially #1 if your environment is heavily virtualized and dynamically orchestrated.

3. Palo Alto Networks: excellent credit-based alternative

Palo Alto Networks's VM-Series now supports Software NGFW Credits, where you purchase reusable credits and create deployment profiles specifying vCPUs, security services and management components. When a firewall is deactivated, the associated credits are released back into the pool.Palo Alto Networks TechDocs

That's a very strong “grow/shrink/reallocate” mechanism. Palo Alto also offers PAYG licensing through public-cloud marketplaces, but for a private-cloud deployment I'd focus your evaluation on the Software NGFW Credits model rather than assuming public-cloud PAYG translates directly to your environment.Palo Alto Networks TechDocs

Recommendation: #3, particularly if Prisma/PAN-OS capabilities are already important to you.

4. Cisco: flexible, but less purely consumption-based

Cisco Secure Firewall Threat Defense Virtual supports VMware, KVM, OpenStack, Nutanix and Hyper-V in private-cloud/on-prem environments. Its newer licensing is performance-based: you select a throughput tier independently of the VM's underlying CPU/memory allocation.cisco.com

That's useful for scaling throughput without constantly changing the VM, but it's not as inherently consumption-oriented as FortiFlex or Check Point's elastic pools.

Recommendation: consider if you're already heavily invested in Cisco security/networking.

What I'd put in an RFP

I'd specifically ask the vendors to quote the same workload under these models:

When deploying virtual firewalls in a private cloud setting (such as VMware ESXi, KVM, or OpenStack), traditional rigid, perpetual per-core licenses can cause bottlenecks or lead to over-provisioning. To handle dynamic workloads safely via a consumption-based or "pay-as-you-grow" framework, top enterprise firewall vendors rely on pool-based credit or token models rather than native public cloud hourly meter billing (which requires direct hyperscaler infrastructure integration).

The primary vendors offering structured, highly competitive consumption or flexible allocation models for private cloud virtual appliances include:

• Fortinet (FortiFlex / formerly Flex-VM)
  • How it works: FortiFlex provides an on-demand, prepaid point or token subscription model. You purchase an overarching pool of points that burn down based on the exact resources allocated to your FortiGate-VM instances (such as the number of vCPUs assigned, virtual domains/VDOMs, and active security feature bundles like Advanced Malware Protection or IPS).
  • Private Cloud Fit: Highly competitive for private data centers because you can spin virtual firewalls up or down on your hypervisors (VMware, KVM) via tokens. If a VM is decommissioned, the points stop burning or return to your central pool to be reassigned elsewhere instantly.
  • Explore further: Review configuration specs in the FortiFlex Administration Guide.d2ka2attjrjsw4.cloudfront.net+2
• Palo Alto Networks (Flexible VM-Series ELA / Credits)
  • How it works: Palo Alto uses a multi-model Enterprise License Agreement (ELA) or credit-based consumption mechanism where you buy a pool of deployment credits/tokens. Rather than locking you into a specific VM size (like a VM-100 or VM-300), the pool allows you to dynamically scale capacity, throughput tiers, and associated security subscriptions (WildFire, Threat Prevention, URL Filtering) across your private/hybrid environments.
  • Private Cloud Fit: Extremely adaptable for organizations shifting capacity continuously between on-premises private clouds and public cloud enclaves. You allocate tokens to your private cloud hypervisors through Panorama management.
  • Explore further: Read implementation guidelines via the Palo Alto Networks VM-Series Documentation.docs.paloaltonetworks.com+1
• Check Point (CloudGuard Network / Software-Defined Licensing Pools)
  • How it works: Check Point offers pooled, software-defined license allocations where security gateways draw capacity dynamically from a central license pool. Licensing scales according to the number of vCPUs or scaled throughput utilized across the estate rather than rigid node-locked serial numbers.
  • Private Cloud Fit: Using their central license management tools, private cloud gateways (ESXi/KVM) can dynamically check out capacity from the pool, making it effective for automated or elastic private cloud environments.
  • Explore further: Check management workflows via the Check Point CloudGuard Central License Tool Guide.sc1.checkpoint.com+1

Which is Most Competitive?

• Fortinet tends to win on raw unit economics and granular vCPU-level metering via FortiFlex , making it ideal if your private cloud requires strict budget tracking down to the individual core and specific security feature add-on.docs.fortinet.com+2
• Palo Alto Networks is typically preferred if your enterprise prioritizes a high-end unified threat prevention feature set and intends to leverage Panorama to smoothly orchestrate license tokens across hybrid borders without micromanaging individual appliance tiers.docs.paloaltonetworks.com+1

To narrow down the best financial fit, could you share:

• Your approximate throughput requirements (e.g., aggregate gigabits per second across private cloud firewalls)
• Whether you are locked into a specific hypervisor stack (e.g., VMware vSphere/NSX vs. KVM/OpenStack)

For a private cloud virtual firewall deployment, the most competitive “pay-as-you-grow” options are usually not traditional perpetual licenses; they are consumption pools, credits, usage-based subscriptions, or marketplace-style PAYG models. The strongest contenders are typically:

Leading consumption-based choices

1. Fortinet — often the strongest “true consumption” model

Fortinet’s FortiFlex is designed around usage-based licensing. Organizations buy a pool of points and consume them as they deploy virtual security appliances and services. It supports dynamic scaling, including deploying FortiGate VM instances across on-premises, private cloud, hybrid cloud, and other environments.Fortinet+1

Why it is attractive:

• Avoids sizing every firewall instance upfront
• Supports temporary deployments, pilots, and burst capacity
• Better alignment with internal cloud/chargeback models
• Daily usage accounting can reduce idle-license wasteFortinet Documentation

Best fit: Private cloud platforms where firewall capacity changes frequently or where a security team operates like an internal service provider.

---

2. Palo Alto Networks — strongest enterprise flexibility

Palo Alto Networks offers VM-Series licensing through Software NGFW Credits, where organizations consume credits for firewall capacity, security services, and management components rather than buying fixed firewall sizes.Palo Alto Networks TechDocs+1

Advantages:

• Very granular sizing (including flexible vCPU-based licensing)
• Good for large enterprises with multiple environments
• Easier pooling of firewall capacity across teams

Trade-off: Usually optimized for larger enterprise agreements rather than small environments.

---

3. Juniper — good if you already run Junos

Juniper Networks’s vSRX supports subscription and PAYG licensing models, with pricing commonly tied to virtual CPU capacity.Juniper Networks

Best fit:

• Existing Juniper routing/switching customers
• Private clouds built around Junos automation
• Network teams wanting consistent operational tooling

---

How I would shortlist vendors

For a private cloud with variable demand, I would typically rank them:

1. Fortinet FortiFlex — best pure consumption economics and operational flexibility
2. Palo Alto VM-Series with Software NGFW Credits — best enterprise-grade flexible licensing
3. Juniper vSRX — best if Juniper is already strategic
4. Check Point CloudGuard — best for Check Point-heavy organizations
5. Cisco Secure Firewall Virtual — best for Cisco-standardized environments

Questions to ask vendors before selecting

To compare real cost, ask each vendor:

• Is licensing based on vCPU, throughput, sessions, or services enabled?
• Can licenses be paused/reclaimed when VMs are destroyed?
• Can unused capacity be pooled across multiple private clouds?
• Are security subscriptions included or separate?
• Is pricing available monthly, daily, or hourly?
• Can you move capacity between environments without repurchasing?

For many organizations, the lowest total cost comes from a consumption pool model (FortiFlex or Palo Alto credits) rather than a simple hourly PAYG license, especially when virtual firewalls are long-lived but capacity fluctuates.Fortinet+1

For private cloud environments (such as VMware, OpenStack, or Nutanix), traditional cloud marketplace hourly Pay-As-You-Go (PAYG) isn't native. Instead, vendors use points- or credit-based consumption pools . You buy a pool of credits, and your private cloud virtual appliances draw from that pool daily or hourly based on the exact size (vCPUs) and security services you spin up.sdxcentral.com+3

The most competitive and flexible consumption-based models for virtual firewalls in private clouds come from Fortinet and Palo Alto Networks , with Cisco and Sophos offering tier-based variations.cisco.com+3

1. Fortinet (FortiFlex) – Most Cost-Effective & Granular

Fortinet's FortiFlex is widely considered the most aggressive and price-competitive consumption model for private cloud deployments.fortinet.com+2

• How it works: You purchase a prepaid bank of "FortiFlex points".
• Consumption scale: Points are deducted on a daily basis based on the exact configuration of your virtual instances (FortiGate-VM).
• Why it is highly competitive: Fortinet allows you to change the size of the VM (e.g., from 2 vCPUs to 8 vCPUs) or change the security bundle (e.g., standard UTM to full Enterprise protection) on the fly. If you shut down a virtual appliance, it stops consuming points the next day. Fortinet consistently leads the market in price-to-performance utility.pub-livingston.escribemeetings.com+2

2. Palo Alto Networks (Software NGFW Credits) – Best for Premium Feature Flexibility

Palo Alto Networks transitioned its VM-Series virtual firewalls to a flexible, credit-based licensing infrastructure.docs.paloaltonetworks.com+2

• How it works: You purchase a pool of Software NGFW Credits.docs.paloaltonetworks.com+1
• Consumption scale: Credits are consumed based on the number of vCPUs assigned, the specific PAN-OS security subscriptions enabled (Advanced Threat Prevention, WildFire, URL Filtering), and whether Panorama management is utilized.firewall.cx+2
• Why it is competitive: It eliminates the rigid, traditional model where you had to buy specific VM tiers (like VM-100 or VM-300). You can seamlessly scale a private cloud firewall up or down to meet traffic demands, and the credits adjust organically. However, Palo Alto generally carries a premium price benchmark compared to Fortinet.secureitconsult.com+5

3. Cisco (Secure Firewall Threat Defense Virtual) – Performance-Tiered Scaling

Cisco's virtual firewall approach focuses heavily on a performance-based licensing model for hybrid and private clouds.cisco.com+1

• How it works: Rather than metering granular daily points, Cisco licenses its virtual appliances (FTDv ) based on enforced performance envelopes.cisco.com+1
• Consumption scale: Tiers are restricted by maximum throughput (Rate Limits) and concurrent Remote Access VPN session limits.cisco.com+1
• Why it is competitive: While less dynamic than an hourly or daily credit pool, it is ideal for organizations that want a "pay-as-you-grow" roadmap without the unpredictability of metered traffic or consumption spikes. You pay strictly for the performance cap you allocate to the hypervisor.checkpoint.com+2

4. Sophos (Sophos Firewall Virtual) – Flexible Infrastructure Metering

For mid-market private clouds running VMware or Hyper-V, Sophos provides structured scale-out licensing.sophos.com+1

• How it works: While their true metered PAYG models are usually restricted to public marketplaces (like Azure or AWS), they offer flexible, software-defined subscriptions for private hypervisors.sophos.com+2
• Consumption scale: Priced according to the hardware cores (vCPU) and RAM allocated to the virtual appliance.radiant.in+1
• Why it is competitive: Sophos is highly cost-effective for smaller to medium enterprise topologies where complex, multi-tenant credit banks might introduce unnecessary administrative overhead.reddit.com+1

Core Comparison for Private Clouds

If your primary metric for "competitive" is the lowest total cost of ownership (TCO) paired with high deployment granularity, Fortinet FortiFlex typically wins out. If you already rely on centralized security management platforms like Panorama, Palo Alto's credit system gives you identical architectural flexibility for your software-defined data center (SDDC).fortinet.com+4

If you'd like to narrow this down, please share:

• What hypervisor or private cloud platform you run (e.g., VMware vSphere, Nutanix AHV, OpenStack)?
• Your estimated aggregate throughput or the number of virtual firewalls you plan to deploy?
• Whether you require an upfront pre-purchased credit pool or a true monthly billing setup?

If the requirement is specifically private-cloud virtual firewalls with genuinely consumption-oriented licensing, I’d put Fortinet, Palo Alto Networks, and Check Point at the top of the shortlist, with Juniper as another credible option. Cisco is attractive if you also need public-cloud PAYG, but its private-cloud model is less consumption-oriented.

Best fits

1. Fortinet — strongest match

Fortinet's FortiFlex is probably the first program I'd benchmark. It uses a points-based consumption model: you purchase a pool of points and consume them across supported Fortinet virtual security products. Entitlements are charged daily, capacity can be increased or decreased, unused points can roll over, and FortiFlex supports virtualized data centers and on-premises/private-cloud environments.Fortinet

That is unusually close to the "pay as you grow" model you're describing because you're not necessarily locked into a particular VM size or number of firewall instances.

Best for: organizations expecting the number or size of virtual firewalls to fluctuate significantly.

2. Palo Alto Networks — strongest enterprise alternative

Palo Alto Networks's VM-Series supports flexible Software NGFW Credits, where credits can be allocated through deployment profiles rather than buying fixed firewall capacity. Palo Alto explicitly positions this for scaling VM-Series up/down in private and public clouds.Palo Alto Networks TechDocs+1

It's also worth noting that VM-Series supports PAYG licensing, although the straightforward marketplace PAYG model is primarily relevant to public clouds.Palo Alto Networks TechDocs

Best for: enterprises that want flexible consumption while retaining Palo Alto's broader security ecosystem.

3. Check Point — very interesting for highly dynamic private clouds

Check Point's CloudGuard Network Security VE has an elastic licensing model based on virtual cores in use, with licenses distributed dynamically from a centralized pool. Check Point specifically describes this as suitable for dynamic workloads and private-cloud environments.Check Point Software

Check Point also has a Metered License solution that introduces PAYG pricing based on actual usage for private-cloud datacenters.Checkpoint

Best for: large VMware/KVM/private-cloud estates where VM count and compute allocation change frequently.

4. Juniper — worth pricing, but not my first choice

Juniper Networks vSRX uses subscription licensing and Juniper Agile Licensing, including vCPU-based licensing for vSRX 3.0.Juniper Networks+1

Its PAYG model is well established in public clouds, but the private-cloud story isn't as cleanly consumption-based as FortiFlex or CloudGuard's elastic licensing.

5. Cisco — good PAYG, but mostly public-cloud oriented

Cisco Secure Firewall Threat Defense Virtual supports VMware, KVM, OpenStack, Nutanix and Hyper-V private-cloud environments. However, Cisco's current documentation indicates that PAYG is available in AWS/Azure, while private-cloud deployments use BYOL.Cisco+1

So I'd rank Cisco lower if private-cloud consumption pricing is a primary procurement criterion.

My shortlist

For an RFP, I'd invite Fortinet, Palo Alto Networks, and Check Point to compete directly.

I'd weight the commercial evaluation roughly like this:

1. Fortinet FortiFlex — 30%: strongest combination of daily consumption, scaling in/out, and private-cloud applicability.
2. Palo Alto VM-Series / Software NGFW Credits — 30%: excellent flexibility, particularly if advanced security capabilities are important.
3. Check Point CloudGuard VE — 25%: excellent elastic core-based model for dynamic private-cloud environments.
4. Juniper vSRX — 10%: credible fourth bid.
5. Cisco FTDv — 5%: consider primarily if Cisco ecosystem alignment is strategically important.

Important caveat: I wouldn't call any of these definitively the cheapest without your workload numbers. Vendors generally don't publish apples-to-apples private-cloud rates; the economic winner can change substantially with average vs. peak vCPU, number of instances, HA requirements, security subscriptions, and whether capacity is continuously running or bursty.

If you give me your approximate number of firewalls, vCPUs per firewall, expected growth, throughput, and whether you're VMware/KVM/OpenStack/Nutanix, I can build a 5-year TCO/RFP comparison and identify which licensing model is likely to be cheapest.

That is unusually close to the "pay as you grow" model you're describing because you're not necessarily locked into a particular VM size or number of firewall instances.

Best for: organizations expecting the number or size of virtual firewalls to fluctuate significantly.

2. Palo Alto Networks — strongest enterprise alternative

Palo Alto Networks's VM-Series supports flexible Software NGFW Credits, where credits can be allocated through deployment profiles rather than buying fixed firewall capacity. Palo Alto explicitly positions this for scaling VM-Series up/down in private and public clouds.Palo Alto Networks TechDocs+1

It's also worth noting that VM-Series supports PAYG licensing, although the straightforward marketplace PAYG model is primarily relevant to public clouds.Palo Alto Networks TechDocs

Best for: enterprises that want flexible consumption while retaining Palo Alto's broader security ecosystem.

3. Check Point — very interesting for highly dynamic private clouds

Check Point's CloudGuard Network Security VE has an elastic licensing model based on virtual cores in use, with licenses distributed dynamically from a centralized pool. Check Point specifically describes this as suitable for dynamic workloads and private-cloud environments.Check Point Software

Check Point also has a Metered License solution that introduces PAYG pricing based on actual usage for private-cloud datacenters.Checkpoint

Best for: large VMware/KVM/private-cloud estates where VM count and compute allocation change frequently.

4. Juniper — worth pricing, but not my first choice

Juniper Networks vSRX uses subscription licensing and Juniper Agile Licensing, including vCPU-based licensing for vSRX 3.0.Juniper Networks+1

Its PAYG model is well established in public clouds, but the private-cloud story isn't as cleanly consumption-based as FortiFlex or CloudGuard's elastic licensing.

5. Cisco — good PAYG, but mostly public-cloud oriented

Cisco Secure Firewall Threat Defense Virtual supports VMware, KVM, OpenStack, Nutanix and Hyper-V private-cloud environments. However, Cisco's current documentation indicates that PAYG is available in AWS/Azure, while private-cloud deployments use BYOL.

So I'd rank Cisco lower if private-cloud consumption pricing is a primary procurement criterion.

My shortlist

For an RFP, I'd invite Fortinet, Palo Alto Networks, and Check Point to compete directly.

I'd weight the commercial evaluation roughly like this: